Vulnerability-Lookup

FKIE_CVE-2026-90045

Vulnerability from fkie_nvd - Published: 2026-09-16 11:17 - Updated: 2026-09-28 23:10

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1625827648f4e1595ea6ba5521bc87ee5088b32b",
              "status": "affected",
              "version": "2e4c7553cd6f9c68bb741582dcb614edcbeca70f",
              "versionType": "git"
            },
            {
              "lessThan": "f3d31484b3f26d63c09e5569ebfaa1079a17f171",
              "status": "affected",
              "version": "2e4c7553cd6f9c68bb741582dcb614edcbeca70f",
              "versionType": "git"
            },
            {
              "lessThan": "7411de0ce3b45286de1de82526795658ea6eacb0",
              "status": "affected",
              "version": "2e4c7553cd6f9c68bb741582dcb614edcbeca70f",
              "versionType": "git"
            },
            {
              "lessThan": "5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8",
              "status": "affected",
              "version": "2e4c7553cd6f9c68bb741582dcb614edcbeca70f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: ffs: fix mm lifetime handling\n\nio_data stores a pointer to the submitting task\u0027s mm_struct,\nbut does not currently hold a reference to it while async\nrequests are pending.\n\nThis can result in a use-after-free if the task exits before\ncompletion handling finishes.\n\nTake a reference with mmgrab() when queuing the read request\nand release it with mmdrop() on request completion."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nUSB: gadget: ffs: corregir la gesti\u00f3n del ciclo de vida de mm\n\nio_data almacena un puntero a la mm_struct de la tarea remitente, pero actualmente no mantiene una referencia a ella mientras las solicitudes as\u00edncronas est\u00e1n pendientes.\n\nEsto puede resultar en un uso despu\u00e9s de liberaci\u00f3n si la tarea finaliza antes de que termine el manejo de la finalizaci\u00f3n.\n\nTomar una referencia con mmgrab() al encolar la solicitud de lectura y liberarla con mmdrop() al completarse la solicitud."
    }
  ],
  "id": "CVE-2026-90045",
  "lastModified": "2026-09-28T23:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T11:17:17.763",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-90045 (GCVE-0-2026-90045)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:33 – Updated: 2026-09-21 13:15

Title

USB: gadget: ffs: fix mm lifetime handling

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/1625827648f4e1595…
https://git.kernel.org/stable/c/f3d31484b3f26d63c…
https://git.kernel.org/stable/c/7411de0ce3b45286d…
https://git.kernel.org/stable/c/5eb5c72c72fef76cb…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2e4c7553cd6f9c68bb741582dcb614edcbeca70f , < 1625827648f4e1595ea6ba5521bc87ee5088b32b (git) Affected: 2e4c7553cd6f9c68bb741582dcb614edcbeca70f , < f3d31484b3f26d63c09e5569ebfaa1079a17f171 (git) Affected: 2e4c7553cd6f9c68bb741582dcb614edcbeca70f , < 7411de0ce3b45286de1de82526795658ea6eacb0 (git) Affected: 2e4c7553cd6f9c68bb741582dcb614edcbeca70f , < 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8 (git)
Linux	Linux	Affected: 3.15 Unaffected: 0 , < 3.15 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1625827648f4e1595ea6ba5521bc87ee5088b32b",
              "status": "affected",
              "version": "2e4c7553cd6f9c68bb741582dcb614edcbeca70f",
              "versionType": "git"
            },
            {
              "lessThan": "f3d31484b3f26d63c09e5569ebfaa1079a17f171",
              "status": "affected",
              "version": "2e4c7553cd6f9c68bb741582dcb614edcbeca70f",
              "versionType": "git"
            },
            {
              "lessThan": "7411de0ce3b45286de1de82526795658ea6eacb0",
              "status": "affected",
              "version": "2e4c7553cd6f9c68bb741582dcb614edcbeca70f",
              "versionType": "git"
            },
            {
              "lessThan": "5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8",
              "status": "affected",
              "version": "2e4c7553cd6f9c68bb741582dcb614edcbeca70f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: ffs: fix mm lifetime handling\n\nio_data stores a pointer to the submitting task\u0027s mm_struct,\nbut does not currently hold a reference to it while async\nrequests are pending.\n\nThis can result in a use-after-free if the task exits before\ncompletion handling finishes.\n\nTake a reference with mmgrab() when queuing the read request\nand release it with mmdrop() on request completion."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached via local aio_read/io_submit on FunctionFS ep files (ffs_epfile_read_iter \u2192 ffs_epfile_io), not by parsing USB host packets. This is the gadget userspace API; prior f_fs AIO UAFs (CVE-2024-36894, CVE-2025-71074) are scored Local, which is also the higher-severity vector versus Physical.\nAC:L - The attacker submits the AIO read, can complete it locally (dummy_hcd or an already-bound gadget) and exit while the ordered io_completion_wq worker is still pending. Both sides of the mm-lifetime race are attacker-driven and freely retryable, so this is not AC:H.\nPR:L - ffs_epfile_open has no capability check. FunctionFS mounts commonly set uid=/gid=/fmode= so unprivileged gadget daemons (adbd/shell, MTP) can open ep files; mounting needs init-namespace CAP_SYS_ADMIN, but using already-mounted endpoints does not.\nUI:N - The attacker performs io_submit and process exit itself. No separate victim action is required beyond an already-deployed FunctionFS gadget.\nS:U - The mm_struct use-after-free corrupts host kernel state within the same security authority. This is standard local kernel privilege escalation, not a VM, IOMMU, or sandbox escape.\nC:H - Use-after-free of mm_struct lets kthread_use_mm/switch_mm consume a reclaimed mm (including mm-\u003epgd) and copy_to_iter through attacker-influenced page tables, yielding an arbitrary read primitive. Per scoring guidance, UAF is Confidentiality High.\nI:H - kthread_use_mm on a sprayed mm_struct can install attacker-controlled page tables, and ffs_copy_to_iter then writes the USB payload through them, giving an arbitrary write and control-flow hijack primitive. Per scoring guidance, UAF is Integrity High.\nA:H - Using a freed mm_struct in kthread_use_mm/switch_mm and copy_to_iter reliably oopses or panics the kernel even without a full exploit, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:15:19.588Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171"
        },
        {
          "url": "https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8"
        }
      ],
      "title": "USB: gadget: ffs: fix mm lifetime handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90045",
    "datePublished": "2026-09-16T10:33:42.411Z",
    "dateReserved": "2026-09-11T19:38:34.783Z",
    "dateUpdated": "2026-09-21T13:15:19.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-90045

CVE-2026-90045 (GCVE-0-2026-90045)

Tags

Sightings

Nomenclature

Related by attack behaviour